CST CRF Compliance Services: How GHS Helps ICT Licensees

July 22, 2026 · 6 min read · GHS Security Team
CST CRF Compliance Services in Saudi Arabia: How GHS Helps ICT Licensees | GHS

CST CRF · GRC Advisory · ICT Licensees

CST CRF Compliance Services in Saudi Arabia: How GHS Helps ICT Licensees

July 14, 2026 · 6 min read · GHS Security Team CST CRF GRC Advisory ICT Compliance

Quick Answer

GHS helps Saudi ICT licensees get and stay compliant with CST’s Cybersecurity Regulatory Framework (CRF) through a structured engagement: a gap assessment against the six CRF control domains at your target Compliance Level, a prioritized roadmap from CL1 through CL3, hands-on support building the evidence CST assessors expect, and a full pre-audit simulation before the real thing.

We work with licensees at every stage — from a first CL1 baseline to organizations stuck on the CL2-to-CL3 transition — and for licensees that are also NCA ECC or CCRF in scope, we build one control map that covers every applicable framework instead of running separate projects per regulator.

If you’re a CST-licensed ICT Service Provider in Saudi Arabia, you already know CRF isn’t optional — it’s covered elsewhere on our blog in our full CST CRF explainer. What that guide doesn’t cover is the part licensees actually ask us about first: who does the work of getting compliant, and how. This post is that answer.

Why Do ICT Licensees Bring in GHS for CST CRF?

Three recurring situations bring licensees to us:

  • →Starting from zero. A newly licensed provider, or one that has never formally assessed itself against CRF, needs a baseline gap assessment and a realistic CL1 roadmap.
  • →Stalled between CL2 and CL3. The most common stall point — a licensee has documented controls but can’t yet prove they’re continuously monitored and improving, which is exactly what CL3 assessments check for.
  • →An assessment is already scheduled. A licensee has a CST review on the calendar and needs evidence organized, gaps closed, and a dry run completed before assessors arrive.

What Does a GHS CST CRF Engagement Actually Include?

1

Gap Assessment

We benchmark your current controls against all six CRF domains — governance, asset management, risk management, logical security, physical security, and third-party security — at your target Compliance Level.

2

CL1 → CL3 Roadmap

A prioritized, sequenced plan — governance quick wins first, then formal risk management, then continuous-monitoring capability — scoped to your team’s actual capacity, not a generic checklist.

3

Evidence Build-Out

Hands-on support producing the artifacts assessors actually ask for — policies, risk registers, access logs, monitoring records — not just advice on what to write.

4

Pre-Audit Simulation

A full dry run of the CST assessment experience, surfacing weak answers and missing evidence while there’s still time to fix them.

How Does GHS Handle Licensees Also Subject to NCA ECC or CCRF?

Most large telecom operators and hosting providers aren’t just CRF-scoped — many are also designated Critical National Infrastructure under NCA ECC, and many also offer cloud services that pull in the Cloud Computing Regulatory Framework (CCRF). Running three separate compliance tracks for overlapping controls — governance, access management, physical security — wastes time and multiplies audit fatigue. GHS builds a single control map spanning every framework a licensee is actually subject to, so evidence gathered once satisfies CRF, ECC, and CCRF assessments alike. We track this evidence on an ongoing basis inside ComplyOS, so the next assessment cycle is a status check, not a rebuild.

GHS Perspective

The licensees who move fastest through CRF are the ones who treat CL1 through CL3 as one continuous program with a single owner — not three separate certification sprints handed off between teams. That’s the model we build every engagement around.

What Does Engaging GHS for CST CRF Look Like Timeline-Wise?

Stage Typical Duration Outcome
CL1 baseline 4–6 weeks Gap assessment + remediation plan for foundational controls
CL2 build-out 2–4 months Formal risk management, deeper logical/physical controls
CL3 maturity Ongoing program Continuous monitoring, metrics-driven improvement

Where you start on this table depends entirely on where your program stands today — a gap assessment in week one tells us exactly which row you’re starting from.

Frequently Asked Questions: CST CRF Compliance Services

GHS runs a structured CST CRF engagement for ICT licensees: a gap assessment against the six control domains at your target Compliance Level, a prioritized remediation roadmap from CL1 through CL3, hands-on support building the evidence auditors expect, and a full pre-audit simulation before CST’s assessment. The goal is a licensee that walks into its CRF assessment with no surprises.
Any CST-licensed ICT Service Provider in Saudi Arabia — telecom operators, ISPs, and hosting or data center providers — needs a CRF compliance program. GHS works with licensees at every stage: those starting from zero at CL1, those stalled on the CL2-to-CL3 transition, and those preparing evidence ahead of a scheduled CST assessment.
A baseline CL1 gap assessment and remediation plan typically runs 4 to 6 weeks. Building out to CL2 with formal risk management and deeper technical controls generally takes 2 to 4 months depending on organizational size. Reaching CL3 continuous-monitoring maturity is an ongoing program, not a fixed project, since it depends on sustained evidence collection rather than a one-time build.
Yes. Many ICT licensees are also designated Critical National Infrastructure and must satisfy NCA ECC alongside CRF. GHS builds a single control map covering both frameworks so evidence is gathered once and reused across each assessment, rather than running two disconnected compliance projects.
Yes. Licensees that also provide cloud services typically need both CRF and CCRF. GHS scopes engagements to cover both frameworks together where they apply, since a meaningful share of the underlying evidence — governance, access management, physical security — overlaps between them.
CST CRF GRC Advisory ICT Compliance CL1 CL2 CL3 Saudi Arabia

Get Your CST CRF Gap Assessment

GHS benchmarks your current controls against CRF’s six domains at your target Compliance Level and hands you a prioritized roadmap — no generic checklist, no guesswork.

Book My Assessment →
← Back to Blog